Add researcher workflow features: exploit tracker, variant search, batch triage, VT/WBI links

- Exploit stage tracker per finding (not_started → recon → poc → tested → working)
- Cross-driver variant search finds similar findings across all analyses
- Batch triage with checkbox selection and bulk state update
- VirusTotal and WinBIndex links on all SHA256 hashes
- Diff empty state with VT download links for manual binary diffing
- Deep-link to specific findings via ?fn= query parameter
- Fix FastAPI route ordering for /bulk before /{function}
- Fix corpus page Set iteration TypeScript error

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: splintersfury

services/dashboard/backend/main.py

@@ -21,6 +21,7 @@
     AlertsResponse,
     Analysis,
     AnalysisListResponse,
+    BulkTriageUpdate,
     CorpusOverview,
     CVECorpusEntry,
     DriverSummary,
@@ -34,6 +35,7 @@
     TriageSummary,
     TriageUpdate,
     VariantAlertEntry,
+    VariantMatch,
 )
 from .storage import FileStorage, MWDBStorage
 from .triage import TriageStore
@@ -435,6 +437,12 @@ async def get_triage_states(analysis_id: str):
     return triage_store.get_for_analysis(analysis_id)
 
 
+@app.put("/api/triage/{analysis_id}/bulk", response_model=list[TriageEntry])
+async def bulk_triage(analysis_id: str, body: BulkTriageUpdate, _auth: None = Depends(require_api_key)):
+    """Bulk update triage state for multiple findings."""
+    return triage_store.set_bulk(analysis_id, body.functions, body.state, body.note)
+
+
 @app.get("/api/triage/{analysis_id}/{function}", response_model=TriageEntry)
 async def get_triage_state(analysis_id: str, function: str):
     """Get triage state for a specific finding."""
@@ -444,7 +452,49 @@ async def get_triage_state(analysis_id: str, function: str):
 @app.put("/api/triage/{analysis_id}/{function}", response_model=TriageEntry)
 async def set_triage_state(analysis_id: str, function: str, body: TriageUpdate, _auth: None = Depends(require_api_key)):
     """Update triage state for a specific finding."""
-    return triage_store.set(analysis_id, function, body.state, body.note)
+    return triage_store.set(analysis_id, function, body.state, body.note, body.exploit_stage)
+
+
+# ==========================================================================
+# Variant Search (cross-driver)
+# ==========================================================================
+
+
+@app.get("/api/variants/{analysis_id}/{function}", response_model=list[VariantMatch])
+async def find_variants(analysis_id: str, function: str):
+    """Find similar findings (same rule_id or category) in other analyses."""
+    source = file_storage.get_analysis(analysis_id)
+    if source is None:
+        raise HTTPException(status_code=404, detail="Analysis not found")
+    source_finding = next((f for f in source.findings if f.function == function), None)
+    if source_finding is None:
+        raise HTTPException(status_code=404, detail="Finding not found")
+
+    matches: list[VariantMatch] = []
+    for item in file_storage.list_analyses():
+        if item.id == analysis_id:
+            continue
+        other = file_storage.get_analysis(item.id)
+        if other is None:
+            continue
+        for f in other.findings:
+            if f.rule_id == source_finding.rule_id or (
+                f.category == source_finding.category
+                and abs(f.final_score - source_finding.final_score) < 3.0
+            ):
+                matches.append(VariantMatch(
+                    analysis_id=item.id,
+                    driver_name=item.driver_name or item.id,
+                    function=f.function,
+                    rule_id=f.rule_id,
+                    category=f.category.value if hasattr(f.category, 'value') else str(f.category),
+                    final_score=f.final_score,
+                    confidence=f.confidence,
+                    reachability_class=f.reachability_class.value if hasattr(f.reachability_class, 'value') else str(f.reachability_class),
+                    created_at=item.created_at.isoformat() if hasattr(item.created_at, 'isoformat') else str(item.created_at),
+                ))
+    matches.sort(key=lambda m: m.final_score, reverse=True)
+    return matches[:30]
 
 
 # ==========================================================================

services/dashboard/backend/models.py

@@ -234,18 +234,35 @@ class TriageState(str, Enum):
     resolved = "resolved"
 
 
+class ExploitStage(str, Enum):
+    not_started = "not_started"
+    recon = "recon"
+    poc = "poc"
+    tested = "tested"
+    working = "working"
+
+
 class TriageEntry(BaseModel):
     """Triage state for a single finding (keyed by analysis_id + function)."""
     analysis_id: str
     function: str
     state: TriageState = TriageState.untriaged
+    exploit_stage: ExploitStage = ExploitStage.not_started
     updated_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
     note: str = ""
 
 
 class TriageUpdate(BaseModel):
     """Request body for updating triage state."""
     state: TriageState
+    exploit_stage: Optional[ExploitStage] = None
+    note: str = ""
+
+
+class BulkTriageUpdate(BaseModel):
+    """Bulk triage request for multiple findings."""
+    functions: list[str]
+    state: TriageState
     note: str = ""
 
 
@@ -326,6 +343,19 @@ class AlertsResponse(BaseModel):
     variants: list[VariantAlertEntry] = []
 
 
+class VariantMatch(BaseModel):
+    """A finding in another analysis with the same rule/category."""
+    analysis_id: str
+    driver_name: str
+    function: str
+    rule_id: str
+    category: str
+    final_score: float
+    confidence: float
+    reachability_class: str
+    created_at: str
+
+
 # --- Search ---
 
 

services/dashboard/backend/triage.py

@@ -12,7 +12,7 @@
 from pathlib import Path
 from typing import Optional
 
-from .models import TriageEntry, TriageState, TriageSummary
+from .models import ExploitStage, TriageEntry, TriageState, TriageSummary
 
 logger = logging.getLogger(__name__)
 
@@ -70,19 +70,52 @@ def set(
         function: str,
         state: TriageState,
         note: str = "",
+        exploit_stage: Optional[ExploitStage] = None,
     ) -> TriageEntry:
         key = self._key(analysis_id, function)
+        # Preserve existing exploit_stage if not explicitly set
+        existing_exploit = ExploitStage.not_started
+        if key in self._data:
+            existing_exploit = ExploitStage(self._data[key].get("exploit_stage", "not_started"))
         entry = TriageEntry(
             analysis_id=analysis_id,
             function=function,
             state=state,
+            exploit_stage=exploit_stage if exploit_stage is not None else existing_exploit,
             updated_at=datetime.now(),
             note=note,
         )
         self._data[key] = entry.model_dump()
         self._save()
         return entry
 
+    def set_bulk(
+        self,
+        analysis_id: str,
+        functions: list[str],
+        state: TriageState,
+        note: str = "",
+    ) -> list[TriageEntry]:
+        """Set triage state for multiple findings at once."""
+        entries = []
+        for func in functions:
+            key = self._key(analysis_id, func)
+            existing_exploit = ExploitStage.not_started
+            if key in self._data:
+                existing_exploit = ExploitStage(self._data[key].get("exploit_stage", "not_started"))
+            entry = TriageEntry(
+                analysis_id=analysis_id,
+                function=func,
+                state=state,
+                exploit_stage=existing_exploit,
+                updated_at=datetime.now(),
+                note=note,
+            )
+            self._data[key] = entry.model_dump()
+            entries.append(entry)
+        self._save()
+        return entries
+
     def summary(self) -> TriageSummary:
         counts = {s.value: 0 for s in TriageState}
         for data in self._data.values():

services/dashboard/frontend/src/app/analysis/[id]/page.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import { useEffect, useState } from "react";
-import { useParams } from "next/navigation";
+import { useParams, useSearchParams } from "next/navigation";
 import type { Analysis, Finding, TriageEntry } from "@/types";
 import { OverviewCards, TrustIndicators } from "@/components/overview-cards";
 import { FindingsTable } from "@/components/findings-table";
@@ -10,7 +10,9 @@ import { formatDate, truncateSha, cn, triageBadge, triageLabel } from "@/lib/uti
 
 export default function AnalysisPage() {
   const params = useParams();
+  const searchParams = useSearchParams();
   const id = params.id as string;
+  const fnParam = searchParams.get("fn");
   const [analysis, setAnalysis] = useState<Analysis | null>(null);
   const [selectedFinding, setSelectedFinding] = useState<Finding | null>(null);
   const [triageStates, setTriageStates] = useState<Record<string, TriageEntry>>({});
@@ -31,16 +33,18 @@ export default function AnalysisPage() {
       .then(([data, triage]: [Analysis, Record<string, TriageEntry>]) => {
         setAnalysis(data);
         setTriageStates(triage || {});
-        if (data.findings.length > 0) {
-          setSelectedFinding(data.findings[0]);
-        }
+        // Deep-link to specific finding if ?fn= is present
+        const target = fnParam
+          ? data.findings.find((f: Finding) => f.function === fnParam)
+          : null;
+        setSelectedFinding(target || data.findings[0] || null);
         setLoading(false);
       })
       .catch((e) => {
         setError(e.message);
         setLoading(false);
       });
-  }, [id]);
+  }, [id, fnParam]);
 
   if (loading) {
     return (
@@ -201,6 +205,13 @@ export default function AnalysisPage() {
             onSelect={setSelectedFinding}
             selectedFunction={selectedFinding?.function}
             triageStates={triageStates}
+            analysisId={id}
+            onTriageUpdate={() => {
+              // Refresh triage states after bulk update
+              fetch(`/api/triage/${id}`)
+                .then((res) => (res.ok ? res.json() : {}))
+                .then((data) => setTriageStates(data || {}));
+            }}
           />
         </div>
       </div>

services/dashboard/frontend/src/app/corpus/page.tsx

@@ -875,9 +875,9 @@ export default function CorpusPage() {
   }
 
   // Unique categories from CVEs
-  const allCategories = [
-    ...new Set(data.cves.map((c) => c.expected_category_primary).filter(Boolean)),
-  ].sort();
+  const allCategories = Array.from(
+    new Set(data.cves.map((c) => c.expected_category_primary).filter(Boolean))
+  ).sort();
 
   // Apply filters
   const filteredCves = data.cves.filter((cve) => {

services/dashboard/frontend/src/components/diff-viewer.tsx

@@ -1,5 +1,7 @@
 interface DiffViewerProps {
   snippet: string;
+  shaNew?: string;
+  shaOld?: string;
 }
 
 function classifyLine(line: string): string {
@@ -10,11 +12,36 @@ function classifyLine(line: string): string {
   return "diff-line-context";
 }
 
-export function DiffViewer({ snippet }: DiffViewerProps) {
+export function DiffViewer({ snippet, shaNew, shaOld }: DiffViewerProps) {
   if (!snippet) {
     return (
-      <div className="rounded-lg border bg-muted/50 p-4 text-sm text-muted-foreground">
-        No diff available
+      <div className="rounded-lg border bg-muted/50 p-4 text-center">
+        <p className="text-sm text-muted-foreground">No diff snippet available for this finding.</p>
+        {(shaNew || shaOld) && (
+          <div className="mt-2 flex items-center justify-center gap-3">
+            <span className="text-xs text-muted-foreground">Download binaries to diff manually:</span>
+            {shaOld && (
+              <a
+                href={`https://www.virustotal.com/gui/file/${shaOld}`}
+                target="_blank"
+                rel="noopener noreferrer"
+                className="rounded px-2 py-1 text-xs font-medium bg-blue-500/10 text-blue-600 hover:bg-blue-500/20 dark:text-blue-400 transition-colors"
+              >
+                Old (VT)
+              </a>
+            )}
+            {shaNew && (
+              <a
+                href={`https://www.virustotal.com/gui/file/${shaNew}`}
+                target="_blank"
+                rel="noopener noreferrer"
+                className="rounded px-2 py-1 text-xs font-medium bg-blue-500/10 text-blue-600 hover:bg-blue-500/20 dark:text-blue-400 transition-colors"
+              >
+                New (VT)
+              </a>
+            )}
+          </div>
+        )}
       </div>
     );
   }

services/dashboard/frontend/src/components/exploit-tracker.tsx

@@ -0,0 +1,72 @@
+"use client";
+
+import { useState } from "react";
+import { setTriageState } from "@/lib/api";
+import { cn } from "@/lib/utils";
+import type { ExploitStage, TriageState } from "@/types";
+
+const STAGES: { value: ExploitStage; label: string; color: string }[] = [
+  { value: "not_started", label: "Not Started", color: "bg-gray-400" },
+  { value: "recon", label: "Recon", color: "bg-blue-500" },
+  { value: "poc", label: "PoC", color: "bg-yellow-500" },
+  { value: "tested", label: "Tested", color: "bg-orange-500" },
+  { value: "working", label: "Working", color: "bg-red-500" },
+];
+
+interface ExploitTrackerProps {
+  analysisId: string;
+  functionName: string;
+  currentStage: ExploitStage;
+}
+
+export function ExploitTracker({
+  analysisId,
+  functionName,
+  currentStage,
+}: ExploitTrackerProps) {
+  const [stage, setStage] = useState<ExploitStage>(currentStage);
+  const [saving, setSaving] = useState(false);
+
+  const currentIndex = STAGES.findIndex((s) => s.value === stage);
+
+  const handleClick = async (newStage: ExploitStage) => {
+    setSaving(true);
+    try {
+      // We need a non-untriaged state for exploit tracking to make sense
+      const triageState: TriageState = "investigating";
+      await setTriageState(analysisId, functionName, triageState, "", newStage);
+      setStage(newStage);
+    } catch (e) {
+      console.error("Failed to update exploit stage:", e);
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  return (
+    <div className="space-y-1.5">
+      <span className="text-xs font-medium text-muted-foreground">
+        Exploit Progress:
+      </span>
+      <div className="flex items-center gap-1">
+        {STAGES.map((s, i) => (
+          <button
+            key={s.value}
+            onClick={() => handleClick(s.value)}
+            disabled={saving}
+            title={s.label}
+            className={cn(
+              "flex items-center gap-1 rounded-md px-2 py-1 text-[11px] font-medium transition-colors",
+              i <= currentIndex
+                ? cn(s.color, "text-white")
+                : "bg-muted text-muted-foreground hover:bg-accent",
+              saving && "opacity-50 cursor-not-allowed"
+            )}
+          >
+            {s.label}
+          </button>
+        ))}
+      </div>
+    </div>
+  );
+}